A manager, an agent and a tree of values
The Simple Network Management Protocol (SNMP) has two roles. The manager, usually software on a network management station (NMS), asks; the agent, built into each router, switch or access point, answers. What an agent can report is described in Management Information Bases (MIBs), and every value sits at an object identifier (OID), a dotted path such as 1.3.6.1.2.1.1.5.0 for the device’s name, sysName (RFC 3418).
Polls go down, notifications come up
Get requests read values and Set requests change them; the manager sends both to UDP 161 on the agent. Traps and informs travel the other way, from the agent to UDP 162 on the manager, when something happens: an interface goes down, a power supply fails, a threshold is crossed. An inform is a notification the manager acknowledges, so the agent can send it again if the acknowledgement never arrives; a trap gets no reply. Tools like snmpwalk simply repeat GetNext requests down one branch of the tree.
Where the version names come from
SNMPv1 used community strings. SNMPv2 added GetBulk and informs, and the version that shipped kept the community model; the “c” in v2c stands for community-based (RFC 1901). SNMPv3 keeps the v2 operations and adds the security framework of RFC 3411 to RFC 3418, which is the current IETF standard for SNMP.
The message map
| Message | Sent by | To | Job |
|---|---|---|---|
| GetRequest, GetNextRequest | Manager | Agent, UDP 161 | Read one value, or the next value in the tree |
| GetBulkRequest | Manager | Agent, UDP 161 | Read many values in one exchange (added in SNMPv2) |
| SetRequest | Manager | Agent, UDP 161 | Change a value; needs write access |
| Response | Agent | The manager’s source port | Answer to any request above |
| SNMPv2-Trap | Agent | Manager, UDP 162 | Report an event, no acknowledgement |
| InformRequest | Agent | Manager, UDP 162 | Report an event and wait for an acknowledgement |
SNMPv2c against SNMPv3
| Point of comparison | SNMPv2c | SNMPv3 |
|---|---|---|
| Who is asking (differs) | A community string, readable by anyone on the path | A named user in the User-based Security Model (RFC 3414) |
| Authentication (differs) | None beyond knowing the string | Keyed hash (HMAC), depending on the security level |
| Encryption (differs) | None | Available, depending on the security level the user is configured for |
| Access rights (differs) | Read-only or read-write per community; an ACL can limit which stations use it | Set per group, with views that limit which OIDs a user can see |
| Operations | Get, GetNext, GetBulk, Set, Trap, Inform | Get, GetNext, GetBulk, Set, Trap, Inform |
| Ports | UDP 161 and 162 | UDP 161 and 162 |
| Reasonable use (differs) | A lab, or an isolated management network | Anything crossing a shared or untrusted path |
≠ marks rows where the two differ.
Frames on SNMPv2c vs SNMPv3
Work these before the security levels below; decide whether each frame is about the roles, the data model, the version or the command line.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 007 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 007
Which protocol provides a standardized way for network devices to communicate management information to a centralized management station?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
STP prevents Layer 2 loops; it does not report management data to a station.
Note on B
CDP discovers directly connected Cisco neighbors, but it does not report device data to a central station.
Note on C
LLDP is the vendor-neutral neighbor discovery protocol, and it too stays on the local link.
Note on D
Correct: SNMP lets a central manager poll devices (UDP 161) and receive traps or informs from them (UDP 162).
Best answer: D · why
SNMP is the standard protocol for central device monitoring. Agents on routers and switches expose data organized in a MIB; the manager reads it with get requests or changes it with set requests on UDP 161. Agents can also push unsolicited traps or informs to the manager on UDP 162. CDP and LLDP only exchange information between directly connected neighbors.
- Frame 002 of 007
Which SNMP component is a structured collection of information that represents a specific aspect of a managed device?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A PDU is a single SNMP message, such as a Get or a Trap, not a body of device information.
Note on B
An OID names one object inside the MIB; the MIB is the structured collection those OIDs belong to.
Note on C
Correct: the MIB is the hierarchical collection of managed objects that describes a device, and the manager queries it.
Note on D
SMI is the set of rules for defining MIB objects and their data types, not the collection itself.
Best answer: C · why
SNMP organizes device data in a Management Information Base (MIB): a tree of managed objects such as interface counters or CPU load, each with an Object Identifier (OID) like 1.3.6.1.2.1.2.2.1.10. The Structure of Management Information (SMI) defines how such objects are described, and Protocol Data Units (PDUs) are the Get, Set, Response and Trap messages that carry the values.
- Frame 003 of 007
Which SNMP version introduced View-based Access Control Model (VACM) and improved security features?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
There is no SNMPv4; version 3 is the current standard.
Note on B
SNMPv1 had only clear-text community strings, with no user-based security or view-based access model.
Note on C
SNMPv2c improved operations such as GetBulk but kept the clear-text community string.
Note on D
Correct: the SNMPv3 framework added the User-based Security Model (authentication and encryption) and VACM for per-user views of the MIB.
Best answer: D · why
SNMPv1 and v2c authenticate with a community string sent in clear text. SNMPv3 (RFC 3411 to 3418) brought the User-based Security Model, with the noAuthNoPriv, authNoPriv and authPriv levels, and the View-based Access Control Model, which limits which parts of the MIB each user or group may read or write. There is no SNMPv4.
- Frame 004 of 007
Which command is used to configure a Cisco router to send SNMP traps to a management station at 192.168.10.50?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
trap-source picks the interface whose address traps are sent from; it takes an interface name, not the manager’s IP.
Note on B
snmp-server location only stores a text description of where the device sits.
Note on C
Correct: snmp-server host names the trap receiver, the version and the community, so traps go to 192.168.10.50 with v2c community NMSKEY.
Note on D
snmp-server enable traps chooses which trap types are generated, and it takes no destination address.
Best answer: C · why
Sending traps takes two pieces: snmp-server enable traps, which selects the events that generate traps, and snmp-server host <address> [traps|informs] version <1|2c|3> <community or user>, which names the receiver. Here that is snmp-server host 192.168.10.50 traps version 2c NMSKEY. snmp-server trap-source sets the source interface, and snmp-server location is a text label.
- Frame 005 of 007
Which command adds an SNMP community with read-only privileges while restricting SNMP access to a specific IP network on a Cisco router?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
snmp-server host names a trap or inform receiver; it does not define a community or apply an ACL to polling.
Note on B
IOS has no snmp-server access command; restricting pollers is done with the ACL at the end of the community line.
Note on C
snmp-server enable traps selects trap types to send, and it does not create a community string.
Note on D
Correct: snmp-server community <string> ro <acl> creates a read-only community and accepts SNMP requests only from sources the ACL permits.
Best answer: D · why
In SNMPv1 and v2c, the community string acts as a shared password. snmp-server community <string> ro <acl> creates a read-only community (rw would allow set requests), and the optional standard ACL number limits which manager addresses may use it. For example: access-list 10 permit 192.168.10.0 0.0.0.255, then snmp-server community NMSKEY ro 10. snmp-server host defines where traps are sent.
- Frame 006 of 007
For auditing SNMP configuration on a router, which command will display the SNMP community strings along with their access levels from the running configuration?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: filtering the running configuration for snmp-server community lines shows each community string with its ro or rw keyword and any ACL.
Note on B
show snmp statistics reports SNMP packet counters, not the configured communities.
Note on C
This filter shows which trap types are enabled, not the community strings and their access levels.
Note on D
snmp-server community is a configuration command that creates a community; it displays nothing.
Best answer: A · why
Communities are configured with snmp-server community <string> ro|rw [acl], so the quickest audit is show running-config | include snmp-server community, which lists every such line. SNMP status and counter commands report traffic rather than configuration, and snmp-server community itself is a configuration command, not a display command.
- Frame 007 of 007
A monitoring server polls core routers with SNMP across a shared WAN. Policy requires every SNMP message to be authenticated and its contents encrypted. Which choice meets the policy?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
authNoPriv authenticates messages and protects their integrity but sends the contents unencrypted, so it fails the encryption requirement.
Note on B
noAuthNoPriv identifies users by name only, with neither authentication nor encryption. It is the weakest SNMPv3 level.
Note on C
Correct. authPriv is the SNMPv3 level that both authenticates each message and encrypts its contents, which is what the policy requires.
Note on D
SNMPv2c sends the community string in clear text and encrypts nothing. An ACL limits who may poll but does not protect the messages.
Best answer: C · why
SNMPv2c relies on a community string sent in clear text. SNMPv3 adds the User-based Security Model (RFC 3414) and defines three security levels (RFC 3411). noAuthNoPriv has neither authentication nor privacy. authNoPriv authenticates each message with a keyed hash but leaves the contents readable. authPriv authenticates and also encrypts (privacy), so only it satisfies a policy that needs both. On Cisco IOS this level is the ‘priv’ keyword on an SNMPv3 group, with users configured with auth and priv passwords. Sources: RFC 3411 and RFC 3414.
The security levels, decoded
- noAuthNoPriv
- The username must match; no hash and no encryption.
- authNoPriv
- Each message carries a hash that proves who sent it and that it was not altered; the contents stay readable.
- authPriv
- The hash plus encryption of the message contents.
The same levels on an IOS router
A read-only group at the encrypted level, one user, one trap receiver
snmp-server group NOC-RO v3 privsnmp-server user nms1 NOC-RO v3 auth sha Auth-Key-2026 priv aes 128 Priv-Key-2026snmp-server host 192.0.2.40 version 3 priv nms1snmp-server enable traps!show snmp usershow snmp grouppriv on the group and host lines selects authPriv; auth would select authNoPriv. IOS does not print snmp-server user lines in the running configuration, so show snmp user is where you confirm the user exists.
Where SNMP sits in the topics
Both exam versions ask you to explain or describe what SNMP does in network operations: v1.1 topic 4.4 and v2.0 topic 5.4, per Cisco’s topic lists. It belongs to the management services in device management, NTP, SNMP, syslog and QoS, next to syslog severities and NTP.
SNMP proves who a polling station is. Who may log in to the device and change it is a separate question, answered by AAA servers and compared on TACACS+ vs RADIUS.